== DF-3611 harness: kzalloc failure at state 2 of 4 in si_parse_power_table ==

[A] Buggy path (si_dpm.c:6853-6856 + 7085):
    state 2: kzalloc(ni_ps) fails -> kfree(dpm.ps); return -ENOMEM
      dpm.ps block freed; pointer LEFT DANGLING in rdev->pm.dpm.ps
      leaked so far: 2 live allocations (ps_priv of states 0..1)
    si_dpm_init rc=-12; radeon_pm.c:1448 IGNORES it; dpm enable fails;
    kernel keeps running with dangling rdev->pm.dpm.ps = 0x8004904c0
    [heap churn] victim object now lives at      0x8004904c0 (SAME block — recycled)
    [unload] si_dpm_fini: for(i<num_ps=0) skipped; kfree(dpm.ps=0x8004904c0)
    >>> DOUBLE FREE of a LIVE object <<<
    next allocation gets same block at 0x8004904c0; write via 2nd owner:
      victim->marker  = 0x4141414141414141 (owner #1 view)
      other->marker   = 0x4141414141414141 (owner #2 view)
      victim->marker was silently CLOBBERED -> use-after-free
      >>> In kernel: cross-object type confusion; any struct of the
          same size class (e.g. radeon bo, gart pages array) is freed
          while referenced -> arbitrary UAF <<<

[B] Fixed path (fix.diff: free privs, kfree + NULL on error; fini guards):
    error path frees all 0 live allocations, NULLs dpm.ps, rc propagated
    si_dpm_fini: dpm.ps == NULL -> no-op (no double free)
    clean: no dangling pointer, 0 bytes leaked
RUN_RC=0